Leaving this completely unrelated link to a better alternative here: https://jellyfin.org/
Leaving this for people to realize that there's a literal chapter's worth of book of security issues that haven't been fixed and seems to keep getting the can kicked down the road... for over 4 years now.
https://github.com/jellyfin/jellyfin/issues/5415
I love Jellyfin... people need to implement it sensibly knowing the potential risks.
Edit: Ah yes! I MUST be a shill for saying "Implement it sensibly".
Here, let me "de-shill" myself.
You have several options to make Jellyfin serviceable to users outside of your literal LAN network.
- setup a VPN. Pray you don't have a user on a device that doesn't have a VPN app that you can work with.
- setup whitelisting on your server. Pray that IP addresses don't change.
- setup fail2ban or crowdsec. Pray that you users don't piss off either by doing user things and getting locked out.
If anything above fails... you're likely on the hook for support. Hope you plan for that!
- Obfuscate your paths (change
/movies/title (year)/title.ext
to something like/9ZHBrvNH4dKQDYFa2parH32qqSFpjsWTataVkjy4NqPxpVktT55PkEee5YSVRvUQ/movies/title (year)/title.ext
). MD5 is now much harder to generate/guess... pray that there isn't some other vulnerability. Gotta go back and reconfigure and organize your shit. Oh and make sure that your docker mounts aren't crushing the path!
Am I still a Plex shill? BTW I run Jellyfin AND Plex. Literally side by side. Different uses for different cases because Jellyfin just can't compete with Plex for sharing with dumb-ass relatives.
If your use case is to have a nice media sever at home and while traveling (via tailscale or similar) without exposing your private data, Jellyfin is great.
If your use case is running a pirate tv service for other people, then you probably want something else.
If you're support ANYONE other than yourself who isn't technical, it's a hurdle. And likely a significant one.
I would not be able to educate my wife properly on the times when she would need to enable wireguard on her phone to use it properly (and when to disable it for other scenarios).
This has nothing to do with running a pirate service.
Seriously it baffles me how so many advocates of Jellyfin don’t recognize the huge gulf of technical knowledge needed to set up plex vs Jellyfin. It doesn’t even compare.
Seriously. Someone tried convincing me that it would be an easy lift to send my MIL across the country a preconfigured Pi so that she could have web browser access to Jellyfin. She only has a computer for doing taxes, and watches everything on her TV.
Not only would she get confused every step of the way, even if it was just plug & play, she would also blame me if ANYTHING happened on her network and want me to fly out to fix it.
I'm not about to take that responsibility just so she can watch the latest episode of 90 day fiance. I have enough pain when she needs to sign into Plex.
Setup a wireguard client so it’s always connected but is used only for a certain IP (the address of your server). If you’re interested, I can help you with that.
It's not me that's the problem. I have a permanent tunnel back to my house/infrastructure (straight wireguard). It's communicating how to use it to my users that the problem... I already do enough support that I'm just not opening that can of worms to non-tech people.
everybody downvoting your comment has zero experience being the go-to family tech guy for relatives in their 80s and 90s who can't reliably distinguish between windows, dialog boxes, menus, and buttons
Me wondering how many security issues the completely proprietary Plex has that they won't tell us about.
Honestly this is something that needs to talked about more. I frequently see people roasting on foss but in reality the proprietary vendors have all sorts of dumb security issues.
Without authentication; it's possible to randomly generate UUIDs and use them to retrieve media from a jellyfin server. That's about the only actually concerning issue on that list, and it's incredibly minor IMO.
With authentication, users (ie, the people you have trusted to access your server) can potentially attack each other, by changing each others settings and viewing each other's watch history/favorites/etc.
That's it. These issues aren't even worth talking about for 99.9% of jellyfin users.
Should they be fixed? Sure, eventually. But these issues aren't cause to yell about how insecure jellyfin is in every single conversation, and to go trying to scare everyone off of hosting it publicly. Stop spreading FUD.
Imagine downvoting "Be careful what you expose to the internet". I thought I'd got away from Reddit.
Well this thread is an absolute shitshow.
Jellyfin is great, but if you refuse to let yourself understand that Plex's ease of setup for remote access is a point in its favour - especially when sharing with non-tech savvy people - then you're just as bad as the supposed "Plex shills".
Plex is well on the enshittification train, and I've always been a bit concerned about how private it may or may not be, but there's absolutely no way I'd have been able to share a Jellyfin instance with my grandfather, especially as his dementia got worse.
I as an arch using turbonerd absolutely love jellyfin and how I can make it do what I want.
I run plex too, because the support I'd have to provide to family members when they need a password reset, or the jellyfin app doesn't work right on their new Hisense smart TV would be the death of me.
"Reviews" but there's only one.
This is probably some employee who genuinely likes the U.I.
An actual company-sponsored campaign would NOT use names from actual employees.
Is it fake or just a review by an employee that uses plex?
Yeah, I`m all for roasting Plex but nothing about that review is inappropriate or prima facie untruthful.
This review would have had a lot more credibility if he at least disclosed his affiliation with Plex. Instead, he posed as some unbiased rando while advertising Plex Pass. This is textbook gaslighting.
If you look on Plex's review page in the Play Store, it's receiving overwhelming amounts of negative reviews over the new UI changes, reliability/performance problems, and how the Lifetime Plex Pass purchase is a lifetime of regrets as they watch Plex getting worse every month by enshittifying itself.
If Plex is resorting to leaving fake reviews to save face, then this company is in deeper trouble than I thought.
This is textbook gaslighting.
Well if I spent 5 minutes instead of 0.5 minutes I might be able to find an actual text book but I think APA Dictionary of Psychology: "gaslight" is a pretty good definition:
to manipulate another person into doubting their perceptions, experiences, or understanding of events.
And it provides an example, from the original source of the term:
a wife is nearly driven to insanity by the deceptions of her husband
It is tres shitty to minimize actual abusive behavior by applying a term associated with intimate partner violence it to this minor thing which is someone posting a comment on some software he works at using an account which goes to zero effort to obfuscate that.
In penance I decree you should watch the movie https://archive.org/details/gaslight-1944 and tell me if it's any good, I haven't seen it yet.
Dude just could have said something like,"Hey, I'm a developer of Plex and have really enjoyed my experience using it. Let me know if you'd like to see something added/fixed."
I don't count this as fake. He most certainly uses the software and the features he described are actually features under plex pass. And I no doubt believe he enjoys it. No lies here. My experience with plex pass is the same lol.
I think the point being made is that company staff shouldn't be leaving five-star reviews on products they, themselves, work on. Whether they do it because they love the product, or a company suit told them to. Personally, I think it's fine to try and convince people to use your/your company's software, but giving yourself a five-star review to do so is downright pathetic.
They seriously enshitified the download feature. You used to be able to set it to download X number of unplayed episodes. Then it would manage downloading fresh content for you as you watched stuff. Now you have to manually download each and every episode yourself. This was literally the killer feature Plex had over Jellyfin for me.
In addition: Sharing this post form r/selfhosted which also describes the recent Plex situation lately, worth a read.
What do ya know, yet another day of being happy I never invested in Plex
And of course the twats locked the thread.
Is the user from Playstore the real Rui Lebre? I mean, I can create on any platform users with real people names, but how can people know that it is the real person that is creating the comment, not just an imposter?
Don't know for sure ofc, but the co-founder has commented in the thread without addressing the issue. They've also closed the thread without addressing all together which also seems weird. Surely if it wasn't him they would have said so?
I'm not a fan of Plex and switched to Jellyfin very early on, but I'm a bit confused by the outrage here. He used his real name to report on a UX he built. I see FOSS developers do this all the time, and it seems pretty innocuous.
I can imagine if he generated thousands of anonymous accounts and did the same it'd be very bad, but an author commenting on his own work using his full real name doesn't seem like a conspiracy plot
lol, did he have the AI bros in marketing write it too? If they’re gonna do this they could at least write their own bullshit…
Marketing probably asked everyone to write a review on their internal Slack or something.
I work at a brewery. Am I not allowed to tell people I like the beer I brew? I'm doing this very wrong I guess my brewery has been enshittified by me. Bummer
If you leave your brewery a public review pretending to just be another customer, yeah thats pretty shitty. You kniw what you're doing, don't play games.
Am I not allowed to tell people I like the beer I brew?
That's not really what he's doing though. It would be like if you pretended to be a customer and drink your own beer in front of actual customers and were like "WOW! This beer is super good! The guy who made it has a really big dick!"
It's just shitty to do because it's sheistery as fuck.
Plex employees totally have the right to review Plex in the store. But they should be expected to advertise that they work for Plex...because he didn't the review loses any credibility that it had previously.
you know full well its not a matter of liking the product you're affiliated with, but an undisclosed conflict of interest in an environment where people have a reasonable expectation of transparent, non-biased testimonials from normal end users, not shilling from paid employees.
I was going to say if he writes an app and doesn't like it, something's wrong there
Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!